Academic Commons

Articles

Behavior Profiling of Email

Stolfo, Salvatore; Hershkop, Shlomo; Wang, Ke; Nimeskern, Olivier; Hu, Chia-wei

This paper describes the forensic and intelligence analysis capabilities of the Email Mining Toolkit (EMT) under development at the Columbia Intrusion Detection (IDS) Lab. EMT provides the means of loading, parsing and analyzing email logs, including content, in a wide range of formats. Many tools and techniques have been available from the fields of Information Retrieval (IR) and Natural Language Processing (NLP) for analyzing documents of various sorts, including emails. EMT, however, extends these kinds of analyses with an entirely new set of analyses that model "user behavior." EMT thus models the behavior of individual user email accounts, or groups of accounts, including the "social cliques" revealed by a user's email behavior.

Subjects

Files

More About This Work

Academic Units
Computer Science
Published Here
April 30, 2010

Notes

Intelligence and security informatics: first NSF/NIJ symposium, ISI 2003, Tucson, AZ, USA, June 2-3, 2003: proceedings, Lecture Notes in Computer Science, vol. 2665 (New York: Springer, 2003), pp. 74-90.

Academic Commons provides global access to research and scholarship produced at Columbia University, Barnard College, Teachers College, Union Theological Seminary and Jewish Theological Seminary. Academic Commons is managed by the Columbia University Libraries.